The grinches at JPMorgan Chase on Saturday limited ATM withdrawals by customers to $100 per day and debit purchases to $300 right in the thick of Christmas-shopping weekend.

The move affects 2 million people — about 10 percent of Chase’s customers — who shopped recently at Target stores, which fell victim last week to a massive security breach that compromised as many as 40 million credit- and debit-card numbers.

“We didn’t do that lightly,” Chase spokeswoman Kristin Lemkau told The Post. “We know it’s a bad time of year, but we had to do that immediately to protect our customers and protect their accounts. We’d rather overreact than under-react.”

The new limits will remain in place until the bank reissues potentially compromised debit cards in the next few weeks, the bank said. Credit-card accounts were not affected.

Target on Thursday said hackers made off with nearly 40 million names, card numbers, expiration dates and security codes from its customers. Some of the pilfered numbers are reportedly being sold on the black market.

Citibank spokesman Andrew Brent said the bank is also lowering cash-withdrawal limits for some customers as a precaution.

He would not elaborate on how many customers would be affected or what the limits would be.

Meanwhile, Chase customers who need to withdraw more than $100 cash can do so in person with ID.

Those abroad are out of luck: The bank has frozen those accounts and won’t be issuing any cash outside the United States.

“This is lame. I needed to do some last-minute Christmas shopping,” fumed Mike Hall, 30. “I can still put it on my credit card, but now I’ve got to pay the interest.”